feat: add TDX verifier and TDX-aware TEE prover registry

deploy-config/local.json

@@ -37,8 +37,11 @@
   "sp1Verifier": "0x0000000000000000000000000000000000000000",
   "superchainConfigGuardian": "0x9965507D1a55bcC2695C58ba16FB37d819B0A4dc",
   "superchainConfigIncidentResponder": "0x0000000000000000000000000000000000000000",
+  "tdxVerifier": "0x0000000000000000000000000000000000000001",
   "teeChallenger": "0x976EA74026E726554dB657fA54763abd0C3a0aa9",
   "teeImageHash": "0x0000000000000000000000000000000000000000000000000000000000000001",
+  "teeNitroImageHash": "0x0000000000000000000000000000000000000000000000000000000000000001",
+  "teeTdxImageHash": "0x0000000000000000000000000000000000000000000000000000000000000001",
   "teeProposer": "0x9965507D1a55bcC2695C58ba16FB37d819B0A4dc",
   "zkAggregationHash": "0x0000000000000000000000000000000000000000000000000000000000000000",
   "zkRangeHash": "0x0000000000000000000000000000000000000000000000000000000000000000"

deploy-config/sepolia.json

@@ -36,8 +36,10 @@
   "sp1Verifier": "0x397A5f7f3dBd538f23DE225B51f532c34448dA9B",
   "superchainConfigGuardian": "0xfd1D2e729aE8eEe2E146c033bf4400fE75284301",
   "superchainConfigIncidentResponder": "0x0000000000000000000000000000000000000000",
+  "tdxVerifier": "0x5431a6Fd5365e9629BD2B0969e54c4f09d6781bA",
   "teeChallenger": "0xadc09b63a3ac57a2ce86d946617a18df9db029a1",
-  "teeImageHash": "0xd04c8147410930fade36986c9357fd9a7591231e38e6e87e51183bd5909f509c",
+  "teeNitroImageHash": "0x11fb64617dfa2875d31b0cfb656666fd8cee65eb134fefeca171b9b6b4444a64",
+  "teeTdxImageHash": "0x4cb35ee476a8098c4e567098714c65f5afe25236fc460b38487a356e14e7db66",
   "teeProposer": "0xdb84125f2f4229c81c579f41bc129c71b174eb58",
   "zkAggregationHash": "0x005aa369dd9445e172018a9eaa4a0f9767b2c2079ece90ca120422b3c4c65f11",
   "zkRangeHash": "0x51708a6b4a3b800a14607e902c1aad47719905c12698a3e01ca8b3321761bc52"

deploy-config/zeronet-tdx.json

@@ -0,0 +1,47 @@
+{
+  "baseFeeVaultMinimumWithdrawalAmount": "0x8ac7230489e80000",
+  "baseFeeVaultRecipient": "0x9965507D1a55bcC2695C58ba16FB37d819B0A4dc",
+  "baseFeeVaultWithdrawalNetwork": 0,
+  "batchSenderAddress": "0x3C44CdDdB6a900fa2b585dd299e03d12FA4293BC",
+  "disputeGameFinalityDelaySeconds": 302400,
+  "delayedWETHWithdrawalDelay": 302400,
+  "finalSystemOwner": "0x8C1a617BdB47342F9C17Ac8750E0b070c372C721",
+  "fundDevAccounts": true,
+  "gasPriceOracleBaseFeeScalar": 1368,
+  "gasPriceOracleBlobBaseFeeScalar": 810949,
+  "l1ChainId": 11155111,
+  "l1FeeVaultMinimumWithdrawalAmount": "0x8ac7230489e80000",
+  "l1FeeVaultRecipient": "0x71bE63f3384f5fb98995898A86B02Fb2426c5788",
+  "l1FeeVaultWithdrawalNetwork": 0,
+  "l2ChainId": 84532,
+  "l2GenesisBlockGasLimit": "0x17D7840",
+  "l2OutputOracleStartingBlockNumber": 1,
+  "l2OutputOracleStartingTimestamp": 1,
+  "multiproofBlockInterval": 100,
+  "multiproofConfigHash": "0x12e9c45f19f9817c6d4385fad29e7a70c355502cf0883e76a9a7e478a85d1360",
+  "multiproofGameType": 621,
+  "multiproofGenesisBlockNumber": 0,
+  "multiproofIntermediateBlockInterval": 10,
+  "multiproofGenesisOutputRoot": "0x0000000000000000000000000000000000000000000000000000000000000001",
+  "nitroEnclaveVerifier": "0x2DC52760D13a3C2dF33fcc42913C4dddd8d976B9",
+  "operatorFeeVaultMinimumWithdrawalAmount": "0x8ac7230489e80000",
+  "operatorFeeVaultRecipient": "0x1CBd3b2770909D4e10f157cABC84C7264073C9Ec",
+  "operatorFeeVaultWithdrawalNetwork": 0,
+  "p2pSequencerAddress": "0x9965507D1a55bcC2695C58ba16FB37d819B0A4dc",
+  "proofMaturityDelaySeconds": 604800,
+  "proxyAdminOwner": "0x9965507D1a55bcC2695C58ba16FB37d819B0A4dc",
+  "respectedGameType": 621,
+  "sequencerFeeVaultMinimumWithdrawalAmount": "0x8ac7230489e80000",
+  "sequencerFeeVaultRecipient": "0xfabb0ac9d68b0b445fb7357272ff202c5651694a",
+  "sequencerFeeVaultWithdrawalNetwork": 0,
+  "sp1Verifier": "0x397A5f7f3dBd538f23DE225B51f532c34448dA9B",
+  "superchainConfigGuardian": "0x9965507D1a55bcC2695C58ba16FB37d819B0A4dc",
+  "superchainConfigIncidentResponder": "0x0000000000000000000000000000000000000000",
+  "tdxVerifier": "0xB5F7f92dA7aBfDBDEB8e84EE78765fd0D3D3E092",
+  "teeChallenger": "0xadc09b63a3ac57a2ce86d946617a18df9db029a1",
+  "teeNitroImageHash": "0x0000000000000000000000000000000000000000000000000000000000000000",
+  "teeTdxImageHash": "0x1c879108e766f7b9088773db8530de5ccc6598e4b7cafa0f99914e4896d13903",
+  "teeProposer": "0xf48742fbC039a22C7490f9d670a8c3a8A3D269B2",
+  "zkAggregationHash": "0x0000000000000000000000000000000000000000000000000000000000000000",
+  "zkRangeHash": "0x0000000000000000000000000000000000000000000000000000000000000000"
+}

deployments/11155111-dev-with-tdx.json

@@ -0,0 +1,13 @@
+{
+  "ASRStartingBlockNumber": 43938334,
+  "ASRStartingOutputRoot": "0x729f6af93a8bbd51d0a373ebd727192c4868bd841774a702039f0449ec8d91fd",
+  "AggregateVerifier": "0x289736E889D4493e320fE7B98AFCA6732001d235",
+  "AnchorStateRegistry": "0x497b409e098fd3d2a4efBcF96a1e76478d182feE",
+  "DelayedWETH": "0x24C2D01498C0d270EF0721052a08cCD7e16089ad",
+  "DisputeGameFactory": "0xDbB1d78c054E2b5513D1cf84414dF02b55d6C854",
+  "NitroEnclaveVerifier": "0x2DC52760D13a3C2dF33fcc42913C4dddd8d976B9",
+  "TDXRegistrationManager": "0x44E999A5859c2D12378a349882fAe5805DCE71b9",
+  "TDXVerifier": "0xB5F7f92dA7aBfDBDEB8e84EE78765fd0D3D3E092",
+  "TEEProverRegistry": "0x33F75D81F84050123C754f467a1035F60085b34b",
+  "TEEVerifier": "0xF78C23d075baf6F7d36B3061f1d1f583ADbD4Bf5"
+}

deployments/11155111-tdx-verifier.json

@@ -0,0 +1,7 @@
+{
+  "IntelRootCaHash": "0xa1acc73eb45794fa1734f14d882e91925b6006f79d3bb2460df9d01b333d7009",
+  "MaxTimeDiff": 3600,
+  "RiscZeroVerifierRouter": "0x925d8331ddc0a1F0d96E68CF073DFE1d92b69187",
+  "TDXVerifier": "0x9c38b756B31529Cad02D54A4ba810F3ff1e00054",
+  "TDXVerifierId": "0xb9681d1f76f5dbf70da84ad06b5b20befa392638060e947965269b6f63ebbf3b"
+}

deployments/11155111-tee-verifiers.json

@@ -0,0 +1,4 @@
+{
+  "NitroEnclaveVerifier": "0x2DC52760D13a3C2dF33fcc42913C4dddd8d976B9",
+  "TDXVerifier": "0xB5F7f92dA7aBfDBDEB8e84EE78765fd0D3D3E092"
+}

deployments/560048-dev-no-nitro.json

@@ -0,0 +1,11 @@
+{
+  "ASRStartingBlockNumber": 4353541,
+  "ASRStartingOutputRoot": "0xb63f4c2646f83e684e14f6a217332ef8c372e95281269384cdb2aa93efd3109a",
+  "AggregateVerifier": "0x2aB6e58257e9F2689F8a17464450e1cf3870BAD1",
+  "AnchorStateRegistry": "0xc14F7E178BfE6209d30c431a8C69b4EcE6d15334",
+  "DelayedWETH": "0x4fc52f45202cfa48Cb84308B05A0D2A6adBAbBF0",
+  "DisputeGameFactory": "0x8e993853C303288f4fcd138E180E31a3c798E4F9",
+  "TDXVerifier": "0x0000000000000000000000000000000000000001",
+  "TEEProverRegistry": "0x8BE44CA11B9F81111242D0f854Db9171B3978Fc7",
+  "TEEVerifier": "0x09F9E99d379A9963Fe13814b31B90ba81bf9a74f"
+}

interfaces/L1/proofs/IAggregateVerifier.sol

@@ -18,7 +18,8 @@ interface IAggregateVerifier is IDisputeGame {
     function DISPUTE_GAME_FACTORY() external view returns (IDisputeGameFactory);
     function DELAYED_WETH() external view returns (IDelayedWETH);
     function TEE_VERIFIER() external view returns (IVerifier);
-    function TEE_IMAGE_HASH() external view returns (bytes32);
+    function TEE_NITRO_IMAGE_HASH() external view returns (bytes32);
+    function TEE_TDX_IMAGE_HASH() external view returns (bytes32);
     function ZK_VERIFIER() external view returns (IVerifier);
     function ZK_RANGE_HASH() external view returns (bytes32);
     function ZK_AGGREGATE_HASH() external view returns (bytes32);

interfaces/L1/proofs/tee/ITDXVerifier.sol

@@ -0,0 +1,69 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.0;
+
+/// @notice Result emitted by the Confidential Space TDX verifier guest.
+enum TDXVerificationResult {
+    Unknown,
+    Success,
+    TokenMalformed,
+    TokenSignatureInvalid,
+    RootCaNotTrusted,
+    TokenClaimsInvalid,
+    TokenExpired,
+    TokenNonceMismatch
+}
+
+/// @notice Public journal emitted by the offchain/ZK Confidential Space verifier.
+/// @param result Overall token verification result.
+/// @param issuedAt Token issuance time in seconds since Unix epoch.
+/// @param expiration Token expiration time in seconds since Unix epoch.
+/// @param rootCaHash Hash of the Google Confidential Space root CA.
+/// @param tokenLeafCertHash Hash of the token leaf certificate.
+/// @param publicKey Uncompressed secp256k1 public key.
+/// @param signer Ethereum address derived from `publicKey`.
+/// @param imageHash OCI manifest digest for the prover workload.
+/// @param audienceHash Hash of the token audience.
+/// @param tokenNonceHash Hash of the signer-bound registrar nonce.
+/// @param hardwareModelHash Hash of the token hardware model claim.
+/// @param secureBoot Whether Secure Boot was enabled.
+/// @param debugDisabled Whether the Confidential Space image was debug-disabled since boot.
+/// @param commandOverride Whether the workload command was overridden.
+/// @param environmentOverride Whether the workload environment was overridden.
+/// @param chainId L1 chain ID bound into the token nonce.
+/// @param registryAddress TEE prover registry address bound into the token nonce.
+struct TDXVerifierJournal {
+    TDXVerificationResult result;
+    uint64 issuedAt;
+    uint64 expiration;
+    bytes32 rootCaHash;
+    bytes32 tokenLeafCertHash;
+    bytes publicKey;
+    address signer;
+    bytes32 imageHash;
+    bytes32 audienceHash;
+    bytes32 tokenNonceHash;
+    bytes32 hardwareModelHash;
+    bool secureBoot;
+    bool debugDisabled;
+    bool commandOverride;
+    bool environmentOverride;
+    uint64 chainId;
+    address registryAddress;
+}
+
+/// @title ITDXVerifier
+/// @notice Interface for Confidential Space TDX verification used by TDX-aware TEE prover registries.
+interface ITDXVerifier {
+    /// @notice Verifies a ZK proof of a Confidential Space Intel TDX token and returns signer metadata.
+    /// @param output ABI-encoded TDXVerifierJournal public values from the ZK verifier guest.
+    /// @param proofBytes ZK proof bytes.
+    /// @return signer Ethereum address derived from the attested public key.
+    /// @return imageHash OCI manifest digest for the prover workload.
+    function verify(
+        bytes calldata output,
+        bytes calldata proofBytes
+    )
+        external
+        view
+        returns (address signer, bytes32 imageHash);
+}

interfaces/L1/proofs/tee/ITEEProverRegistry.sol

@@ -21,7 +21,7 @@ interface ITEEProverRegistry {
     function deregisterSigner(address signer) external;
     function isValidSigner(address signer) external view returns (bool);
     function getRegisteredSigners() external view returns (address[] memory);
-    function getExpectedImageHash() external view returns (bytes32);
+    function getExpectedImageHash(uint8 teeType) external view returns (bytes32);
     function initialize(
         address initialOwner,
         address initialManager,

scripts/deploy/DeployConfig.s.sol

@@ -22,6 +22,7 @@ contract DeployConfig is Script {
     address public sp1Verifier;
     address public superchainConfigGuardian;
     address public superchainConfigIncidentResponder;
+    address public tdxVerifier;
     address public teeChallenger;
     address public teeProposer;
 
@@ -31,6 +32,8 @@ contract DeployConfig is Script {
     bytes32 public multiproofConfigHash;
     bytes32 public multiproofGenesisOutputRoot;
     bytes32 public teeImageHash;
+    bytes32 public teeNitroImageHash;
+    bytes32 public teeTdxImageHash;
     bytes32 public zkAggregationHash;
     bytes32 public zkRangeHash;
 
@@ -75,14 +78,17 @@ contract DeployConfig is Script {
         sp1Verifier = _json.readAddress("$.sp1Verifier");
         superchainConfigGuardian = _json.readAddress("$.superchainConfigGuardian");
         superchainConfigIncidentResponder = _json.readAddress("$.superchainConfigIncidentResponder");
+        tdxVerifier = _json.readAddressOr("$.tdxVerifier", address(0));
         teeChallenger = _json.readAddress("$.teeChallenger");
         teeProposer = _json.readAddress("$.teeProposer");
 
         fundDevAccounts = _json.readBoolOr("$.fundDevAccounts", false);
 
         multiproofConfigHash = _json.readBytes32("$.multiproofConfigHash");
         multiproofGenesisOutputRoot = _json.readBytes32("$.multiproofGenesisOutputRoot");
-        teeImageHash = _json.readBytes32("$.teeImageHash");
+        teeImageHash = _json.readBytes32Or("$.teeImageHash", bytes32(0));
+        teeNitroImageHash = _json.readBytes32Or("$.teeNitroImageHash", teeImageHash);
+        teeTdxImageHash = _json.readBytes32Or("$.teeTdxImageHash", teeImageHash);
         zkAggregationHash = _json.readBytes32("$.zkAggregationHash");
         zkRangeHash = _json.readBytes32("$.zkRangeHash");
 

scripts/deploy/SystemDeploy.s.sol

@@ -37,6 +37,7 @@ import { AggregateVerifier } from "src/L1/proofs/AggregateVerifier.sol";
 import { TEEProverRegistry } from "src/L1/proofs/tee/TEEProverRegistry.sol";
 import { TEEVerifier } from "src/L1/proofs/tee/TEEVerifier.sol";
 import { INitroEnclaveVerifier } from "interfaces/L1/proofs/tee/INitroEnclaveVerifier.sol";
+import { ITDXVerifier } from "interfaces/L1/proofs/tee/ITDXVerifier.sol";
 import { ISP1Verifier } from "interfaces/L1/proofs/zk/ISP1Verifier.sol";
 import { ZKVerifier } from "src/L1/proofs/zk/ZKVerifier.sol";
 import { Constants } from "src/libraries/Constants.sol";
@@ -72,12 +73,14 @@ contract SystemDeploy is Script {
         uint256 withdrawalDelaySeconds;
         uint256 proofMaturityDelaySeconds;
         uint256 disputeGameFinalityDelaySeconds;
-        bytes32 teeImageHash;
+        bytes32 teeNitroImageHash;
+        bytes32 teeTdxImageHash;
         bytes32 zkRangeHash;
         bytes32 zkAggregationHash;
         bytes32 multiproofConfigHash;
         uint256 multiproofGameType;
         address nitroEnclaveVerifier;
+        address tdxVerifier;
         uint256 multiproofBlockInterval;
         uint256 multiproofIntermediateBlockInterval;
         ISP1Verifier sp1Verifier;
@@ -120,7 +123,8 @@ contract SystemDeploy is Script {
         IDelayedWETH delayedWETH;
         IVerifier teeVerifier;
         IVerifier zkVerifier;
-        bytes32 teeImageHash;
+        bytes32 teeNitroImageHash;
+        bytes32 teeTdxImageHash;
         bytes32 zkRangeHash;
         bytes32 zkAggregationHash;
         bytes32 multiproofConfigHash;
@@ -257,12 +261,14 @@ contract SystemDeploy is Script {
             withdrawalDelaySeconds: cfg.delayedWETHWithdrawalDelay(),
             proofMaturityDelaySeconds: cfg.proofMaturityDelaySeconds(),
             disputeGameFinalityDelaySeconds: cfg.disputeGameFinalityDelaySeconds(),
-            teeImageHash: cfg.teeImageHash(),
+            teeNitroImageHash: cfg.teeNitroImageHash(),
+            teeTdxImageHash: cfg.teeTdxImageHash(),
             zkRangeHash: cfg.zkRangeHash(),
             zkAggregationHash: cfg.zkAggregationHash(),
             multiproofConfigHash: cfg.multiproofConfigHash(),
             multiproofGameType: cfg.multiproofGameType(),
             nitroEnclaveVerifier: cfg.nitroEnclaveVerifier(),
+            tdxVerifier: cfg.tdxVerifier(),
             multiproofBlockInterval: cfg.multiproofBlockInterval(),
             multiproofIntermediateBlockInterval: cfg.multiproofIntermediateBlockInterval(),
             sp1Verifier: ISP1Verifier(cfg.sp1Verifier()),
@@ -961,7 +967,9 @@ contract SystemDeploy is Script {
 
         vm.broadcast(msg.sender);
         output_.teeProverRegistryImpl = new TEEProverRegistry(
-            INitroEnclaveVerifier(_input.nitroEnclaveVerifier), _output.disputeGameFactoryProxy
+            INitroEnclaveVerifier(_input.nitroEnclaveVerifier),
+            ITDXVerifier(_input.tdxVerifier),
+            _output.disputeGameFactoryProxy
         );
 
         output_.teeProverRegistryProxy =
@@ -1003,7 +1011,8 @@ contract SystemDeploy is Script {
                 delayedWETH: _output.delayedWETHProxy,
                 teeVerifier: output_.teeVerifier,
                 zkVerifier: output_.zkVerifier,
-                teeImageHash: _input.teeImageHash,
+                teeNitroImageHash: _input.teeNitroImageHash,
+                teeTdxImageHash: _input.teeTdxImageHash,
                 zkRangeHash: _input.zkRangeHash,
                 zkAggregationHash: _input.zkAggregationHash,
                 multiproofConfigHash: _input.multiproofConfigHash,
@@ -1033,7 +1042,8 @@ contract SystemDeploy is Script {
                     _input.delayedWETH,
                     _input.teeVerifier,
                     _input.zkVerifier,
-                    _input.teeImageHash,
+                    _input.teeNitroImageHash,
+                    _input.teeTdxImageHash,
                     AggregateVerifier.ZkHashes(_input.zkRangeHash, _input.zkAggregationHash),
                     _input.multiproofConfigHash,
                     _input.l2ChainId,
@@ -1066,14 +1076,17 @@ contract SystemDeploy is Script {
     }
 
     function _assertValidMultiproofInput(ImplementationInput memory _input) internal view {
-        require(_input.teeImageHash != bytes32(0), "SystemDeploy: teeImageHash not set");
+        require(_input.teeNitroImageHash != bytes32(0), "SystemDeploy: teeNitroImageHash not set");
+        require(_input.teeTdxImageHash != bytes32(0), "SystemDeploy: teeTdxImageHash not set");
         require(_input.zkRangeHash != bytes32(0), "SystemDeploy: zkRangeHash not set");
         require(_input.zkAggregationHash != bytes32(0), "SystemDeploy: zkAggregationHash not set");
         require(_input.multiproofConfigHash != bytes32(0), "SystemDeploy: multiproofConfigHash not set");
         require(_input.multiproofGameType != 0, "SystemDeploy: multiproofGameType not set");
         require(_input.nitroEnclaveVerifier != address(0), "SystemDeploy: nitroEnclaveVerifier not set");
+        require(_input.tdxVerifier != address(0), "SystemDeploy: tdxVerifier not set");
         require(address(_input.sp1Verifier) != address(0), "SystemDeploy: sp1Verifier not set");
         DeployUtils.assertValidContractAddress(_input.nitroEnclaveVerifier);
+        DeployUtils.assertValidContractAddress(_input.tdxVerifier);
         DeployUtils.assertValidContractAddress(address(_input.sp1Verifier));
         require(_input.multiproofBlockInterval != 0, "SystemDeploy: multiproof block interval not set");
         require(